"Remove Integrated Windows Authentication (IWA) Identity Source from the vCenter Server" pre-check error message during VCF 9.x upgrade

Products

• VMware vCenter Server
• VMware Cloud Foundation

Issue/Introduction

During vCenter Server upgrade to VCF 9.x, an administrator will get the following pre-check error message to remove the IWA Identity source:

Please remove all Identity Sources with type Active Directory (Integrated Windows Authentication) before proceeding https://knowledge.broadcom.com/external/article?articleId=373005

Environment

VCF 9.x
vCenter Server 7.x
vCenter Server 8.x

Cause

VCF 9.x removes the support for the IWA Identity Source from the vCenter Server Single Sign On.

Resolution

Before upgrading to VCF 9.x, an existing vCenter Server Appliance from an older version must remove the existing IWA Identity Source. The vCenter Server administrator must manually remove the IWA Identity Source and ensure alternative authentication. Customers can use MFA through federated authentication. See here for more information on Configuring vCenter Server Identity Provider Federation.

Follow below steps to remove the IWA Identity Source on vCenter Server. 

1. Log in with the vSphere Client to the vCenter Server.
2. Specify the user name and password for [email protected] or another member of the vCenter Single Sign-On Administrators group.
3. Navigate to the Configuration UI
4. From the Home menu, select Administration.
   • Under Single Sign On, click Configuration.
   • Under the Identity Provider tab, click Identity Sources.
5. In the Identity Sources tab, select the Identity source with type Active Directory (Integrated Windows Authentication).
6. Click Remove. Click OK to confirm the removal.

Then follow one of the below options to unjoin the VC from the domain and restart vCenter.

Procedure to leave the vCenter Server from the Active Directory domain.

Option 1 : Using the vSphere Client (GUI)

1. Log in with the vSphere Client to the vCenter Server.
2. Specify the user name and password for [email protected] or another member of the vCenter Single Sign-On Administrators group.
3. Navigate to the Configuration UI
   • From the Home menu, select Administration.
   • Under Single Sign On, click Configuration.
4. Under the Identity Provider tab, click Active Directory Domain.
5. Click Leave AD, enter the Active Directory user name and password, and click Leave.
6. Restart the vCenter Server.

Option 2 : Using the Command Line Interface (CLI)

If the vSphere Client is unavailable or returning errors, you can leave the domain directly from the vCenter Server appliance CLI:

1. Verify Domain Join Status:
   /opt/likewise/bin/domainjoin-cli query
   
   
2. Command to Leave Domain:
   /opt/likewise/bin/domainjoin-cli leave

or specify the domain explicitly:

/opt/likewise/bin/domainjoin-cli leave <DomainName.com>

After running these commands, restart the vCenter Server.